Malwarebytes Jobs API
Jobs are tasks that are issued to endpoints. Use these APIs to manage, search, and export jobs.
OpenAPI Specification
openapi: 3.2.0
info:
title: Malwarebytes Jobs API
version: 1.0.0
description: 'Operations tagged Jobs across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Jobs
description: Jobs are tasks that are issued to endpoints. Use these APIs to manage, search, and export jobs.
paths:
/nebula/v1/parent_jobs/{correlation_id}/children:
servers:
- url: https://api.threatdown.com
delete:
description: Cancel children jobs.
summary: Cancel children jobs
security:
- client_credentials:
- execute
- user_permissions:
- tasks.manage
status:
outage:
- auth
parameters:
- name: correlation_id
required: true
in: path
description: Correlation ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Cancel children jobs request body.
properties:
constraints:
type: array
title: Child Jobs Constraints
items:
title: Child Jobs Constraints
type: object
oneOf:
- title: String (Equals, Not Equals) Constraints
required:
- operator
- value
properties:
field:
type: string
oneOf:
- type: string
title: Child Jobs UID String Fields
enum:
- id
- issued_by
- source_id
- reissue_id
- machine_id
- group_id
- cancelled_by
- title: Child Jobs Simple String Fields
type: string
enum:
- command
- issued_by_name
- issued_by_email
- machine_name
- type: string
title: Child Jobs Enum Number Fields
enum:
- status
operator:
type: string
description: Operator to apply to the constraint
enum:
- equals
- not_equals
value:
type:
- string
- array
title: Value to search
items:
type: string
case_insensitive:
type: boolean
default: false
if:
properties:
field:
type: string
title: Child Jobs UID String Fields
enum:
- id
- issued_by
- source_id
- reissue_id
- machine_id
- group_id
- cancelled_by
then:
properties:
value:
type:
- string
- array
format: uuid
items:
type: string
format: uuid
- title: String (Contains, Not Contains) Constraints
required:
- operator
- value
properties:
field:
title: Child Jobs Simple String Fields
type: string
enum:
- command
- issued_by_name
- issued_by_email
- machine_name
operator:
type: string
description: Operator to apply to the constraint
enum:
- contains
- not_contains
value:
type: string
title: Value to search
case_insensitive:
type: boolean
default: false
- title: Date (start, end) Constraints
properties:
field:
type: string
title: Child Jobs Date Fields
enum:
- created_at
- expires_at
- updated_at
oneOf:
- minProperties: 1
title: Specify Date Range
not:
anyOf:
- required:
- operator
- required:
- value
properties:
start:
type: string
format: date-time
title: Start Date
end:
type: string
format: date-time
title: End Date
- title: Specify Exact Date
not:
anyOf:
- required:
- start
- required:
- end
required:
- operator
- value
properties:
operator:
type: string
enum:
- equals
value:
type:
- string
- array
format: date-time
title: Value to search
items:
format: date-time
responses:
'200':
description: Successful response
tags:
- Jobs
operationId: api.v2.nebula.delete.parent_jobs.children
post:
description: Search children jobs by correlation ID.
summary: Search children jobs
security:
- client_credentials:
- read
- user_permissions:
- tasks.view
status:
outage:
- auth
parameters:
- name: correlation_id
required: true
in: path
description: Correlation ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Search children jobs request body.
properties:
sort_field:
type: string
title: Child Jobs Sort Fields
enum:
- created_at
- expires_at
- command
- issued_by_name
- issued_by_email
- updated_at
sort_order:
type: string
title: Whether sorting should be ascending or descending
enum:
- asc
- desc
default: desc
page_size:
type: number
title: The page size
minimum: 0
maximum: 2000
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
constraints:
type: array
title: Child Jobs Constraints
items:
title: Child Jobs Constraints
type: object
oneOf:
- title: String (Equals, Not Equals) Constraints
required:
- operator
- value
properties:
field:
type: string
oneOf:
- type: string
title: Child Jobs UID String Fields
enum:
- id
- issued_by
- source_id
- reissue_id
- machine_id
- group_id
- cancelled_by
- title: Child Jobs Simple String Fields
type: string
enum:
- command
- issued_by_name
- issued_by_email
- machine_name
- type: string
title: Child Jobs Enum Number Fields
enum:
- status
operator:
type: string
description: Operator to apply to the constraint
enum:
- equals
- not_equals
value:
type:
- string
- array
title: Value to search
items:
type: string
case_insensitive:
type: boolean
default: false
if:
properties:
field:
type: string
title: Child Jobs UID String Fields
enum:
- id
- issued_by
- source_id
- reissue_id
- machine_id
- group_id
- cancelled_by
then:
properties:
value:
type:
- string
- array
format: uuid
items:
type: string
format: uuid
- title: String (Contains, Not Contains) Constraints
required:
- operator
- value
properties:
field:
title: Child Jobs Simple String Fields
type: string
enum:
- command
- issued_by_name
- issued_by_email
- machine_name
operator:
type: string
description: Operator to apply to the constraint
enum:
- contains
- not_contains
value:
type: string
title: Value to search
case_insensitive:
type: boolean
default: false
- title: Date (start, end) Constraints
properties:
field:
type: string
title: Child Jobs Date Fields
enum:
- created_at
- expires_at
- updated_at
oneOf:
- minProperties: 1
title: Specify Date Range
not:
anyOf:
- required:
- operator
- required:
- value
properties:
start:
type: string
format: date-time
title: Start Date
end:
type: string
format: date-time
title: End Date
- title: Specify Exact Date
not:
anyOf:
- required:
- start
- required:
- end
required:
- operator
- value
properties:
operator:
type: string
enum:
- equals
value:
type:
- string
- array
format: date-time
title: Value to search
items:
format: date-time
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Search children jobs response body.
properties:
counts:
type: object
title: Counts
properties:
endpoints:
type: integer
title: Number of related endpoints
accounts:
type: integer
title: Number of related accounts
total:
type: integer
title: Total number of child jobs
allOf:
- type: object
title: Job status counts.
required:
- created
- sent
- received
- processing
- timed_out
- success
- expired
- cancelled
- failed
properties:
created:
type: integer
title: Number of jobs with created status
sent:
type: integer
title: Number of jobs with sent status
received:
type: integer
title: Number of jobs with received status
processing:
type: integer
title: Number of jobs with processing status
timed_out:
type: integer
title: Number of jobs with timed_out status
success:
type: integer
title: Number of jobs with success status
expired:
type: integer
title: Number of jobs with expired status
cancelled:
type: integer
title: Number of jobs with cancelled status
failed:
type: integer
title: Number of jobs with failed status
jobs:
type: array
items:
type: object
additionalProperties: false
properties:
id:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
title: The job ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
account_id:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
title: Account ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
machine_id:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
title: The machine ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
machine_name:
type: string
title: The machine name
command:
type: string
title: Command name
issued_at:
type: string
format: date-time
title: The issue date
issued_by_email:
type: string
title: The email of the user who issued the job
issued_by_name:
type: string
title: The name of the user who issued the job
issued_by:
type:
- string
- 'null'
title: The id of the user who issued the job (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
cancelled_by:
type:
- string
- 'null'
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
title: The id of the user who cancelled the job (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
cancelled_by_name:
type:
- string
- 'null'
title: User who cancelled the job
examples:
- John Doe
expires_at:
type: string
format: date-time
title: The expire date
updated_at:
type: string
format: date-time
title: The last update date
state:
type: number
enum:
- 0
- 1
- 2
- 4
- 8
- 16
- 32
- 64
- 128
- 256
title: Filter job status. 0:UNKNOWN_STATUS, 1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED
reason:
type:
- string
- 'null'
title: The reason for the job cancellation
examples:
- Unsupported feature for this OS version.
data:
type: string
title: JSON stringified additional data
correlation_id:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
title: Correlation ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
total_count:
type: integer
title: Total Count
description: Total count of results.
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
required:
- jobs
- next_cursor
- counts
tags:
- Jobs
operationId: api.v2.nebula.post.parent_jobs.children
/nebula/v1/jobs/bulk:
servers:
- url: https://api.threatdown.com
delete:
description: Cancel pending Jobs
summary: Cancel pending jobs
security:
- client_credentials:
- execute
- user_permissions:
- tasks.manage
status:
outage:
- auth
- search_stateful
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Cancel Jobs
anyOf:
- required:
- job_ids
- required:
- machine_ids
- required:
- groups
properties:
job_ids:
type: array
title: The Job IDs Schema
items:
type: string
title: Job ID
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
machine_ids:
type: array
title: The Machine IDs Schema
items:
type: string
title: Machine ID
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
groups:
type: array
title: Machines
items:
type: object
title: List of queries to select endpoints
allOf:
- type: object
title: Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.
required:
- account_ids
properties:
has_alerts:
type: boolean
title: Indicates whether the endpoint needs attention
name_multi_search:
type: string
title: Search either alias, host name of fully qualified host name
alerts.codes:
type: string
title: Alert codes
is_software_update_available:
type: boolean
title: Indicates whether the agent has an available update
protection_status:
type: string
title: Protection status of the endpoint(s)
pattern: (^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)
is_isolated:
type: boolean
title: Indicates whether the endpoints are isolated or not
suspicious_activity_found:
type: boolean
title: Filter the search to the endpoints that have open suspicious activities
reboot_required:
type: boolean
title: Filter the search to the endpoints needing a reboot
infection_found:
type: boolean
title: Filter the search to the endpoints with one or more security threats found
policy_id:
type: string
title: Filter the search to the endpoints with specified policy (id)
policy_name:
type: string
title: Filter the search to the endpoints with specified policy (name)
policy_etag:
type: string
title: Filter the search to the endpoints with specified policy etag
domain_name:
type: string
title: Filter the search to the endpoints with specified domain name
engine_version:
type: string
title: Filter the search to the endpoints with specified engine version
last_user:
type: string
title: Last user that logged into the machine
last_user.keyword:
type: string
title: Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field.
alias:
type: string
title: Aliases for the machine
plugins.siem.reboot_reason:
type: string
title: Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin
plugins.siem.plugin_version:
type: string
title: Filter the search to the endpoints with specified SIEM plugin version
plugins.siem.alerts.codes:
type: string
title: Filter the search to the endpoints with specified SIEM alerts
plugins.browser_phishing_protection.plugin_version:
type: string
title: Filter the search to the endpoints with specified Browser Phishing Protection plugin version
plugins.browser_phishing_protection.alerts.codes:
type: string
title: Filter the search to the endpoints with specified Browser Phishing Protection alerts
plugins.incident_response.reboot_reason:
type: string
title: Filter the search to the endpoints with specified reboot reason, as reported by IR plugin
plugins.incident_response.plugin_version:
type: string
title: Filter the search to the endpoints with specified IR plugin version
plugins.incident_response.alerts.codes:
type: string
title: Filter the search to the endpoints with specified IR plugin alerts
plugins.endpoint_detection_and_response.reboot_reason:
type: string
title: Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin
plugins.endpoint_detection_and_response.plugin_version:
type: string
title: Filter the search to the endpoints with specified EDR plugin version
plugins.endpoint_detection_and_response.alerts.codes:
type: string
title: Filter the search to the endpoints with specified EDR plugin alerts
plugins.endpoint_protection.reboot_reason:
type: string
title: Filter the search to the endpoints with specified reboot reason, as reported by EP plugin
plugins.endpoint_protection.update_package_version:
type: string
title: Filter the search to the endpoints with specified EP update package version
plugins.endpoint_protection.component_package_version:
type: string
title: Filter the search to the endpoints with specified EP component package version
plugins.endpoint_protection.sdk_version:
type: string
title: Filter the search to the endpoints with specified EP SDK version
plugins.endpoint_pro
# --- truncated at 32 KB (528 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-jobs-api-openapi.yml